Using hidden fields for bot detection

An apparatus, comprising:

• one or more memories storing code;
• and
• one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:
• receive information associated with a request to access one or more resources that are protected by an identity management platform, the information comprising at least an Internet Protocol (IP) address associated with the request;
• transmit, to the IP address associated with the request, data corresponding to a login page associated with accessing the one or more resources, the data comprising one or more login fields that are detectable when the login page is rendered and at least one hidden field that is undetectable when the login page is rendered;
• receive, from the IP address associated with the request, a login response comprising a first set of one or more inputs corresponding to the one or more login fields that are detectable when the login page is rendered and a second set of one or more inputs corresponding to the at least one hidden field that is undetectable when the login page is rendered;
• determine that the IP address associated with the request corresponds to an unauthorized entity based at least in part on the login response including the second set of one or more inputs for the at least one hidden field in the login page;
• and
• add the IP address of the unauthorized entity to a set of untrusted IP addresses maintained by the identity management platform, wherein the set of untrusted IP addresses comprises one or more untrusted IP addresses provided by an external data source.

A non-transitory computer-readable medium that stores code comprising instructions executable by one or more processors to:

• receive information associated with a request to access one or more resources that are protected by an identity management platform, the information comprising at least an Internet Protocol (IP) address associated with the request;
• transmit, to the IP address associated with the request, data corresponding to a login page associated with accessing the one or more resources, the data comprising one or more login fields that are detectable when the login page is rendered and at least one hidden field that is undetectable when the login page is rendered;
• receive, from the IP address associated with the request, a login response comprising a first set of one or more inputs corresponding to the one or more login fields that are detectable when the login page is rendered and a second set of one or more inputs corresponding to the at least one hidden field that is undetectable when the login page is rendered;
• determine that the IP address associated with the request corresponds to an unauthorized entity based at least in part on the login response including the second set of one or more inputs for the at least one hidden field in the login page;
• and
• add the IP address of the unauthorized entity to a set of untrusted IP addresses associated with the identity management platform, wherein the set of untrusted IP addresses comprises one or more untrusted IP addresses provided by an external data source.